Skip to content

prost-build: return errors for missing message names and field type names - #1455

Open
Boulea7 wants to merge 2 commits into
tokio-rs:masterfrom
Boulea7:fix/prost-malformed-message-descriptors
Open

Boulea7 wants to merge 2 commits into
tokio-rs:masterfrom
Boulea7:fix/prost-malformed-message-descriptors

Conversation

@Boulea7

@Boulea7 Boulea7 commented Aug 10, 2026 •

Copy link
Copy Markdown

Summary

  • make MessageGraph construction fallible and validate required descriptor values before graph/code generation
  • return io::ErrorKind::InvalidInput when message or enum names are missing or empty
  • return io::ErrorKind::InvalidInput when Message, Group, or Enum field type_name values are missing or empty, including repeated fields
  • add panic-safe regression coverage for each of these malformed descriptor cases

Scope

This change intentionally validates only required message and enum names and required field type_name values for Message, Group, and Enum fields. Non-empty type names retain the existing behavior, and this does not add general FileDescriptorSet validation.

Testing

  • cargo fmt --all --check
  • cargo test -p prost-build (42 unit tests and 21 doctests passed; 7 doctests ignored)
  • cargo test -p prost-build --no-default-features (42 unit tests and 21 doctests passed; 7 doctests ignored)
  • cargo +1.95 test -p prost-build (42 unit tests and 21 doctests passed; 7 doctests ignored)
  • cargo clippy -p prost-build --no-deps --all-features --tests --benches -- -D warnings -A clippy::useless_borrows_in_formatting

The workspace Clippy command on local Rust 1.97 reports a pre-existing clippy::question_mark warning in prost-types/src/datetime.rs; CI pins Clippy 1.95.

Closes #1415.

Copilot AI lite review requested due to automatic review settings August 10, 2026 15:40

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR makes prost-build more robust when given malformed FileDescriptorSet input by turning two previously panicking descriptor unwraps into proper io::Error returns (surfacing as ErrorKind::InvalidInput) and adding regression tests to lock in the behavior.

Changes:

  • Made MessageGraph construction fallible and replaced panic-prone unwraps with explicit error returns for missing message names and missing non-repeated message-field type_name.
  • Propagated MessageGraph construction failures through Config::generate as io::ErrorKind::InvalidInput.
  • Added unit tests ensuring compile_fds does not panic and returns the expected error kind/message for the two reported malformed descriptor shapes.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
prost-build/src/message_graph.rs Makes message graph building return Result and converts the two panic paths into explicit errors.
prost-build/src/config.rs Maps MessageGraph failures to InvalidInput and adds regression tests for the two malformed-input cases.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

prost-build::compile_fds panics on malformed FileDescriptorSet instead of returning Err

2 participants